Log in Start free

Vulnerability · Published Mar 11, 2025 · Assigned by GitHub_M

CVE-2025-27773SimpleSAMLphp SAML2 library has incorrect signature verification for HTTP-Redirect binding

High 8.6

In plain English

A high-severity security flaw in saml2 from simplesamlphp. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.6High
Exploit odds (30 days)0.4%top 64.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. Prior to versions 4.17.0 and 5.0.0-alpha.20, there is a signature confusion attack in the HTTPRedirect binding. An attacker with any signed SAMLResponse via the HTTP-Redirect binding can cause the application to accept an unsigned message. Versions 4.17.0 and 5.0.0-alpha.20 contain a fix for the issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12simplesamlphp1.19.7-1+deb12u2DEBIAN-CVE-2025-27773
Debian:14simplesamlphp1.19.7-2DEBIAN-CVE-2025-27773
Packagistsimplesamlphp/saml24.17.0GHSA-46r4-f8gj-xg56
Packagistsimplesamlphp/saml25.0.0-alpha.20GHSA-46r4-f8gj-xg56
Packagistsimplesamlphp/saml2-legacy4.17.0GHSA-46r4-f8gj-xg56
Ubuntu:24.04:LTSsimplesamlphp1.19.7-1+deb12u1ubuntu0.1USN-8770-1
Ubuntu:24.04:LTSsimplesamlphp1.19.7-1+deb12u1ubuntu0.1UBUNTU-CVE-2025-27773
Ubuntu:25.10simplesamlphpno fix listedUBUNTU-CVE-2025-27773

Affected products (as reported)

VendorProductVersions
simplesamlphp saml2 < 4.17.0>= 5.0.0-alpha.1, < 5.0.0-alpha.20

Weakness: CWE-347 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

References